d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 19.6MB
Sample260910-fpjedsyelg
SHA256 d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851
MD5 6dee08d52ca47b755313ac6125bc132e
SHA1 01e9b8605e45bd9a411efafe635c82646b085677
SHA512 8b72672ce006e03378b8f1ef5f2b474bf966c49dcb2d6185e3d904ae50a102bc6b2bf02586845daeb18fa218959f23174c5c2c9d4e82454a11348f4ce33af0c3
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aAKjKWQc7:AqWqWqWqWqWqWqWq6KWQc0gEYnvLd
TLSH
T16B277D02FADA40B5F8B726704DBBD27A5935BA204B21C9EFE244475E5932FD09E34327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
712	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
3984	svchost_ABCCCBBCCABACABACCBABAAABABCACBACCCACCBCBBCCBBCCAAABBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACBBABCACCABCBCCAAAABACCCAAAACBCABCBCABBCBACAACBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe"	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAABAABACCBBCCAAACCABAAAAACBCAAAAAAAAABBCABBBAAAAACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCBBCCABACABACCBABAAABABCACBACCCACCBCBBCCBBCCAAABBCA.exe"	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1132	sc.exe
3908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe
2004	cmd.exe
5564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCBBCCABACABACCBABAAABABCACBACCCACCBCBBCCBBCCAAABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4384	4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4384 wrote to memory of 5208	4384	cmd.exe	94
PID 4884 wrote to memory of 2004	4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 2004 wrote to memory of 1132	2004	cmd.exe	97
PID 4884 wrote to memory of 5564	4884	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 5564 wrote to memory of 3908	5564	cmd.exe	100
PID 2384 wrote to memory of 3456	2384	svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABABAABABCACCAABBAAAABBBCCCCACCABACBCCBCCBBCACAAAAAACABACAABCAAACCBCACBBCCBAABCBAAAAABCAAACABACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABABAABABCACCAABBAAAABBBCCCCACCABACBCCBCCBBCACAAAAAACABACAABCAAACCBCACBBCCBAABCBAAAAABCAAACABACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe" start= auto displayName= "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe" start= auto displayName= "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACABCBCCABAAABCCABACAAACBBAAACBCBCAAACBAACBBCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
1⤵
- Executes dropped EXE
PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBCCABACABACCBABAAABABCACBACCCACCBCBBCCBBCCAAABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBCCABACABACCBABAAABABCACBACCCACCBCBBCCBBCCAAABBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3dceb79d4e11c2de81190c0efdadc48d68c0c049d6dff30d754bd7ca3be2fb64
MD5 20dc3ad17877e4352541a3bfb58506f6
SHA1 94493442c14d462ca5580314b00b00881d9d70e5
SHA512 4c3dfc861afdad7723cae006a39033ff0e177086d13fcb20a760a079f7685e107af5d37c05a19666724fc5f808e37bd3fe917eb797e8006ad82f6472b42b845b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2003f1427c45811a5bb6eecec985b8df82cf3d8bceb0ce536b483acd90c1649
MD5 5f5d4d1822b2770a74bd9e68c20426d3
SHA1 f4f3fa6ce9dd9b8ce6c731ff43517d0fd6c3cfee
SHA512 43d7f5e77353ae11e7e5d0dfdb4c7a81739323a97660002f74731fda5ad31a1e70e707cbcfaad22c05d26de69fe2e5ce081d36e1df3ee03f0d3860b750012f92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3aff16be3f1b1fa65100bc13d5d53266415c4228d350e441b7427418b65599ba
MD5 42221867b669094ff7e2a27cf172edd5
SHA1 196a55308a731d3e2cdde5b676efeedc4aee4499
SHA512 48318d519ef9b99920159aaba4f7d67ae60877f8a43a93b44d4d3029f8d158873f07d2983b738d5cf21bf40228d5462c4734f123b192a7278e483db047586d37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 31223df4e447a6349e62f379b2d6c466b5132a61bff0648951b187d3a3fafaa6
MD5 3e2bbddee278fac3b817bd0a665a408a
SHA1 be65a40dd858b22a3eb00910dfe2c12bca6b75ec
SHA512 8352b998a4077a9b8fa266a975cc01dcc079bb803eff574dbd3f284c0b14c5a191efc02a1b5f6a3c3ca52a6fa534c45a8a35f032a19f76e7e53135f6d8a782d0
MD5 SHA1 SHA512

Submit Download

svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABBCAACBAAACACBCCCCCCABCBCCCABBAAABAACBAACCBCABABAA.exe
Size 19.6MB
SHA256 d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851
MD5 6dee08d52ca47b755313ac6125bc132e
SHA1 01e9b8605e45bd9a411efafe635c82646b085677
SHA512 8b72672ce006e03378b8f1ef5f2b474bf966c49dcb2d6185e3d904ae50a102bc6b2bf02586845daeb18fa218959f23174c5c2c9d4e82454a11348f4ce33af0c3
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aAKjKWQc7:AqWqWqWqWqWqWqWq6KWQc0gEYnvLd
TLSH
T16B277D02FADA40B5F8B726704DBBD27A5935BA204B21C9EFE244475E5932FD09E34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-24-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/2384-37-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/4884-0-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/4884-8-0x0000000000220000-0x0000000000241000-memory.dmp

Download